@aws-sdk/s3-request-presigner

What is @aws-sdk/s3-request-presigner?

The @aws-sdk/s3-request-presigner package is part of the AWS SDK for JavaScript (v3) and is used to generate pre-signed URLs for AWS S3 objects. This allows clients to perform operations on S3 objects, such as GET or PUT, without requiring AWS credentials, by providing a URL that includes a signature. This is useful for providing temporary access to private objects, uploading files directly from a browser, or any other operation that you want to allow without giving out AWS credentials.

What are @aws-sdk/s3-request-presigner's main functionalities?

Generate pre-signed GET URL

This feature allows you to create a pre-signed URL for a GET request on an S3 object. The URL will be valid for the duration specified by 'expiresIn' (in seconds).

const { S3Client, GetObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

const s3Client = new S3Client({ region: 'us-west-2' });
const getObjectParams = { Bucket: 'my-bucket', Key: 'my-object-key' };
const command = new GetObjectCommand(getObjectParams);

const signedUrl = await getSignedUrl(s3Client, command, { expiresIn: 3600 });
console.log('The signed URL is:', signedUrl);

Generate pre-signed PUT URL

This feature allows you to create a pre-signed URL for a PUT request to upload an object to S3. The URL will be valid for the duration specified by 'expiresIn' (in seconds).

const { S3Client, PutObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

const s3Client = new S3Client({ region: 'us-west-2' });
const putObjectParams = { Bucket: 'my-bucket', Key: 'my-object-key' };
const command = new PutObjectCommand(putObjectParams);

const signedUrl = await getSignedUrl(s3Client, command, { expiresIn: 3600 });
console.log('The signed URL is:', signedUrl);

Other packages similar to @aws-sdk/s3-request-presigner

aws-sdk

The 'aws-sdk' package is the previous version of the AWS SDK for JavaScript. It also supports generating pre-signed URLs for S3 objects, but it is not modular like the newer '@aws-sdk/s3-request-presigner' and includes the entire AWS SDK.

README

@aws-sdk/s3-request-presigner

This package provides a presigner based on signature V4 that will attempt to generate signed url for S3.

Get Presigned URL with Client and Command

You can generated presigned url from S3 client and command. Here's the example:

JavaScript Example:

const { getSignedUrl } = require("@aws-sdk/s3-request-presigner");
const { S3Client, GetObjectCommand } = require("@aws-sdk/client-s3");
const client = new S3Client(clientParams);
const command = new GetObjectCommand(getObjectParams);
const url = await getSignedUrl(client, command, { expiresIn: 3600 });

ES6 Example

import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
const client = new S3Client(clientParams);
const command = new GetObjectCommand(getObjectParams);
const url = await getSignedUrl(client, command, { expiresIn: 3600 });

You can get signed URL for other S3 operations too, like PutObjectCommand. expiresIn config from the examples above is optional. If not set, it's default at 900.

If your request contains server-side encryption(SSE*) configurations, because of S3 limitation, you need to send corresponding headers along with the presigned url. For more information, please go to S3 SSE reference

If you already have a request, you can pre-sign the request following the section bellow.

Get Presigned URL from an Existing Request

JavaScript Example:

const { S3RequestPresigner } = require("@aws-sdk/s3-request-presigner");
const { Sha256 } = require("@aws-crypto/sha256-browser");
const { Hash } = require("@smithy/hash-node");
const signer = new S3RequestPresigner({
  region: regionProvider,
  credentials: credentialsProvider,
  sha256: Hash.bind(null, "sha256"), // In Node.js
  //sha256: Sha256 // In browsers
});
const presigned = await signer.presign(request);

ES6 Example:

import { S3RequestPresigner } from "@aws-sdk/s3-request-presigner";
import { Sha256 } from "@aws-crypto/sha256-browser";
import { Hash } from "@aws-sdk/hash-node";
const signer = new S3RequestPresigner({
  region: regionProvider,
  credentials: credentialsProvider,
  sha256: Hash.bind(null, "sha256"), // In Node.js
  //sha256: Sha256 // In browsers
});
const presigned = await signer.presign(request);

To avoid redundant construction parameters when instantiating the s3 presigner, you can simply spread the configuration of an existing s3 client and supply it to the presigner's constructor.

//s3 is instantiated from S3Client from @aws-sdk/client-s3-* packages
const signer = new S3RequestPresigner({
  ...s3.config,
});

If your request contains server-side encryption(x-amz-server-side-encryption*) headers, because of S3 limitation, you need to send these headers along with the presigned url. That is to say, the url only from calling formatUrl() to presigned is not sufficient to make a request. You need to send the server-side encryption headers along with the url. These headers remain in the presigned.headers

Get Presigned URL with headers that cannot be signed

By using the getSignedUrl with a S3Client you are able to sign your headers, improving the security of presigned url. Importantly, if you want to sign any x-amz-* headers (like the ChecksumSHA256 header in this example), you need to provide those headers to the set of unhoistableHeaders in the getSignedUrl params which will force those headers to be present in the upload request.

import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3Client = new S3Client({ region: "us-east-1" });
const command = new PutObjectCommand({
  Bucket: bucket,
  Key: key,
  ChecksumSHA256: sha,
});

const presigned = getSignedUrl(s3Client, command, {
  expiresIn: expiration,
  // Set of all x-amz-* headers you wish to have signed
  unhoistableHeaders: new Set(["x-amz-checksum-sha256"]),
});

Get Presigned URL with headers that should be signed

For headers that are not x-amz-* you are able to add them to the set of signableHeaders to be enforced in the presigned urls request.

import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3Client = new S3Client({ region: "us-east-1" });
const command = new PutObjectCommand({
  Bucket: bucket,
  Key: key,
  ContentType: contentType,
});

const presigned = getSignedUrl(s3Client, command, {
  signableHeaders: new Set(["content-type"]),
  expiresIn: expiration,
});

For more information, please go to S3 SSE reference

Changelog

3.616.0 (2024-07-18)

Bug Fixes

• lib-storage: location in upload result should include custom port (#6282) (9d3cbb6)
• middleware-sdk-s3: set consistent dependency versions (#6287) (207cd84)

Features

• client-acm-pca: Fix broken waiters for the acm-pca client. Waiters broke in version 1.13.144 of the Boto3 SDK. (a867f6e)
• client-connect: Amazon Connect expands search API coverage for additional resources. Search for hierarchy groups by name, ID, tag, or other criteria (new endpoint). Search for agent statuses by name, ID, tag, or other criteria (new endpoint). Search for users by their assigned proficiencies (enhanced endpoint) (226e9c6)
• client-ec2: Amazon VPC IP Address Manager (IPAM) now supports Bring-Your-Own-IP (BYOIP) for IP addresses registered with any Internet Registry. This feature uses DNS TXT records to validate ownership of a public IP address range. (337c43d)
• client-firehose: This release 1) Add configurable buffering hints for Snowflake as destination. 2) Add ReadFromTimestamp for MSK As Source. Firehose will start reading data from MSK Cluster using offset associated with this timestamp. 3) Gated public beta release to add Apache Iceberg tables as destination. (9a36c7e)
• client-medialive: AWS Elemental MediaLive now supports the SRT protocol via the new SRT Caller input type. (91134df)
• client-sagemaker: SageMaker Training supports R5, T3 and R5D instances family. And SageMaker Processing supports G5 and R5D instances family. (709db60)
• client-taxsettings: Set default endpoint for aws partition. Requests from all regions in aws partition will be forward to us-east-1 endpoint. (7927892)
• clients: update client endpoints as of 2024-07-18 (ac3e31b)